Overview
- Cisco disclosed CVE-2026-76519 in October 2026 and confirmed active exploitation by attackers who send specially crafted email attachments to vulnerable gateways.
- The flaw is a relative path traversal in the Advanced Malware Protection File Reputation flow that can let an attacker write files and run commands as root on the underlying operating system.
- Only SEG appliances with File Reputation enabled and Content Scanner Tools older than 25.3.0.5525 are vulnerable and Cisco provided fixes in Content Scanner Tools 25.3.0.5525 plus AsyncOS builds 15.5.5-014 and 16.5.0-780.
- Cisco warned that attackers with root access can erase local logs so operators must check external network and firewall telemetry, preserve forensic data for virtual machines, and contact TAC if compromise indicators appear.
- Because prior SEG bugs have also led to root access, Cisco recommends rebuilding compromised virtual appliances without importing old configs, rotating credentials and keys, and restoring entire clusters when any member shows compromise.